Services.exe terminated unexpectedly with status code 128.

If you’re using Windows 2000 and meet “”The system process c:\WINNT\System32\Services.exe” terminated unexpectedly with status code 128. The system will now shutdown and restart.”problem when you start the computer, try this KB:

I have the same problem above. I am using widows 2000 server. The error message come up before the login screen. So I can’t even get into windows to change the registry. what should I do? the machine will be restart in one minute after that error message comes up.

I have already update all the security patch and also anti-virus definition. I suspect there ‘s virus on the server.

There is no virus, your registry has become corrupt. It usually occurs when you don’t have the latest service pack update for Win2K. Go to the following URL for more information on how to resolve this problem. http://support.microsoft.com/?scid=kb;EN-US;Q318447

I am having the exact same problem. I cannot log into safe mode either. The Administrator account (which has no password) fails. Is there a way to fix this with the install cd from the recovery console or something?

We (4 PC’s) got attacked by a whole boat load of stuff (adware/spyware/virii,etc.) a couple of days ago. Found lass32.exe using 99% of the cpu, so I killed it, killed the process, deleted all registry entries that referenced it, deleted the file. Now when we boot we get this same error message "Services.exe terminated unexpectedly with status code 128" and the system accounces it is shutting down in 60 seconds. Tried the 318447 tip, no values under the selected keys. Still boots in Safe Mode, but we’ve given up. Reinstalling Windows 2000 now.

4. Back up the registry key: a. On the Registry menu, click Export Registry File.

b. In the File name box, type Shares_RegKey, and then click Save.

This step saves the Shares registry key to the Shares_RegKey text file, which you can use to restore the key in the future. By default, the file is saved in the My Documents folder. For information about how to restore the key, search Regedit Help for the Import Registry Key topic.

5. Examine the list of values in the right pane of Registry Editor.

Notice that the Data column contains the paths to shared folders. For example, you may see a line similar to the following:

CSCFlags=0 MaxUses=4294967295 Path=E:\NS Permissions=0 Remark= Type=0

This refers to the E:\NS shared folder.

6. For each value, use Windows Explorer to make sure that the path displayed in the Data column represents an existing shared folder. Delete all values that do not correspond to shared folders.

I too am having this problem. Tried updating anti-virus, updating window patches, the Carl Andre solution, running anti virus scan outside server startup and nothing has worked. It became so critical that running a complete restore did not resolve the issue.

i dont have any shares so there is no key to edit and its still doing it….

ive reinstalled and keep getting all the same stuff happening no matter what i do. im about to throw my pc through the window please help.. im just glad there is a safe mode with networking so i could see that im not alone.

Here is a fix: If you can boot your server into safe mode, open up the services console and disable a service called "rewt". Once it’s disabled, reboot your server and you should be good to rock and roll! Good Luck!

What I did was install a fresh copy into new dir (this is win2k Pro NOT Server)

and then load into the new install. I then just copied system32 folder from new install over the old one. Once that was done I then booted into old install and works perfectly. Drawback involved is you gotta reinstall most of your drivers. (but you’d have to anyways if the other steps dont work and you have to reinstall ^^)

Had the same problem, tried everything. Then I scanned the hard drive for viruses in another pc and found all sorts of adware, deleted them and away it went. So does look to be a virus/adware related problem.

i am also havin the same problem and i tried the microsoft website which is given above. but i dont see any info (CSCFlags=0 MaxUses=4294967295 Path=E:\NS Permissions=0 Remark= Type=0) in the registry. in shares folder ,on the right side i see (Default) REG_SZ (value not set).

i also tried downloading some virus scanners .windows patch (Windows2000-KB835732-x86-ENU) and (Windows2000-KB823980-x86-ENU) but it didnt work.

i have two logins in my system. i am able to open from the second login, but when i go into the admin login the services.exe error occurs.

I think micorosft’s engineers were a little smoking something when they forgot to implement a tool for editing the registry outside of the os and when they forgot to include this tool into the recovery console.

I caused this exact problem by creating a bogus registry entry while trying to create a DependsOnService entry under HKLM\system\CCS\services\xxxx. As it turns out I was lucky enough to know the exact entry that caused the corruption.

I also could not boot into any of the safe modes, tried repair etc.. eventually loaded a parallel OS install.

I cannot boot into safe mode, (the same message is still there, Cannot boot in anymode actually because the system still shutsdown when services.exe fails. (I thought the point of having safemode was that it didn’t load services?)

The build up to the problem was the exchange mailbox store dismounted for unknown reasons, and would not start again, I restarted the server to make sure all services were restarted, and the system has been shutting it’s self down ever since!

I’ve checked, (taking out the disk) there are not virii

there were no shares (besides the default C$ d$ IPC$ and admin$ so I don’t think it’s that, (although I’m unable to run the regisrty editor to check for this problem as the machine cannot start.

and the machine is

Now I have a production server that cannot/will not start.

I’m having to use Ghost to try to recover data files from it to *try* to recover mail boxes, Microsofts help articles are of little or no use.

Performing a recovery installation of windows seems to have helped the situation…

things are still broken but at least I can use the machine and make an effort to fix the problems!

I have this same problem, but it happens when I just finish installing windows. It’s happened with Win2000 and I’ve had similar problems with WinXP. I am about ready to throw everything in the trash. I have tried three different HDD’s. I even bought a new one….which had the same problem the other ones did. I’m going crazy here.

I was having the same problem. Was looking everywhere for help. I have a program called regseeker that’s been on there for a while. I used it numerous times to clean up my registry. I started in safe mode went to regseeker and had it put in an old backup registry. Restarted and so far everything is good.

I fixed it by using the msconfig utility from an XP Professional machine.

I followed MSFTs fix to the letter and no success.

This is most likely a startup item.

Get a copy of "MSConfig" from an XP Professional machine( yes it runs on Win 2k).

Boot into safe mode and turn off all .ini and system services and startup items , if you can get into Safe Mode if you cannot get into safe mode, back up all of your data and reinstall if you can read below.

With the MSConfig utility you can kill everything at startup the Win.ini, system.ini, boot.ini, services and startup Items. Add things back in one by one until you find the error again.

Be sure to make careful note of what you added so as not to do double work.

The various fixes referenced above did not work for me; it was the security update that did the trick. Since the worm causes reboot when I tried to access the network, I unplugged the network cable and restarted my machine. I then downloaded the patch on another machine and copied it over using flash memory. After installing it on the infected machine I reattached the network cable and everything is fine.

This problem hit us too at August 15th at two different machines using Win2000 SP4. The problem occurs only when connected to the Internet (dial-up or ethernet). As far as I can see for now, update 899588 did the trick!

I started having the same problem yesterday with the difference that my computer shuts down only if I run the Start Active directory Wizard. I am running Windows 2000 Advanced Server. I have tried all of the fixes above (with the exception of installing Windows in another directory and etc…) and none have worked for me. Help?

A friend of mine is having the same "C:\WINNT\system32\services.exe terminated unexpectedly with status code 128" message on his Windows 2000 SP3 Professional system.

Tried many things, including scheduling a chkdsk /r to run at reboot. But it did not solve the problem.

Then realised when i did not do a dial-up to Internet, the message did not appear. So tried dialing up to the Internet, and sure enough, the message pops up almost immediately. Initially suspected it was the Internet Explorer program that is causing the problem, so launch Internet Explorer without dialing up, but message never appears. This leads me to believe the dial-up connection instance is causing the problem.

In the end, set up another instance of the dial-up connection and delete the old one, and thankfully, the message did not appear again.

Just like to share, and hopes this will help those having the same problem.

Linux is NOT really free to enterprises, but more expensive. Why? Consider the support costs from the linux vendors, IT people costs, managing costs, lower effiency (20 minutes’ work to build a well functioning DNS server in Windows Server 2003 but it needs more than 3 hours to build the same thing on a linux server), etc. Compare with Linux, Windows Server has lower total cost of ownership, easy to manage and administer, easier to hire IT people for Windows, etc.

Hi all, I have managed to solve the problem. I spent forever looking through forums applying patches, doing scans etc but the problem still remained! I am using XP SP2.

In the end I copied lsass.exe and services.exe from a ‘clean’ pc. I then used a pre-installed environment disk to access the windows file system and overwrit the originals. It worked! I am aware that most people wont have a PE disk so try this…..

If you copy the files to a floppy disk using the ‘clean’ pc, boot to DOS using a 98 bootdisk and overwrite lsass.exe and services.exe in c:\windows\system32.

I have this same error on an IBM Thinkpad running Windows 2000 Professional updated to the latest service pack.
It was fine until I updated. Now I get the “”The system process c:\WINNT\System32\Services.exe” terminated unexpectedly with status code 128. The system will now shutdown and restart.” message. It says that “This shutdown was initiated by NT AUTHORITY/SYSTEM”.
This only happens when I try to install new devices. The thinkpad will load normally and can be used without a problem, but as soon as I plug in my usb webcam, PCMCIA Wireless LAN card or PCMCIA Bluetooth adapter, I get the message and the Thinkpad restarts. I have done a full scan with AVG and Ad-Aware, and turned up nothing.
When I reboot into safe mode the only value for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares is (Default), the same for HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares\Security.
Any ideas?

That’s kind of the point he was making. Most people, even most techs, don’t have 15 years of experience. Most of us have to learn on the fly and we have to deal with the standard operating system that our company or clients use: Windows. I can’t tell my boss or my clients that I don’t support Windows and that they should change their entire network. That’s ludicrous. Using non-mainstream operating systems/software is the easy way out. It’s avoiding the problem, not dealing with it. It’s only natural that non-mainstream operating systems/software has fewer problems because virus-makers and hackers naturally target the mainstream products.

I believe that those who attempt to solve the actual problem at hand, whether they succeed or fail, are far more intelligent than those who argue semantics and claim that others are clueless.

I haev found that if this is coming up when you are trying to install active directory or running dcpromo that the problem is from the HOSTS file located in c:\WINNT\system32\drivers\etc if you eitehr replace or remove this file then reboot and run the setup again this should solve the problem.

Im using windows 2000 SP4 and i have the same promblem. But my pc restarts when i am connected to the internet. I have done a virus check with AVG and Bitdefender but found nothing.
Can someone help me out here??

I have the same problem too “c:\WINNT\System32\Services.exe” terminated unexpectedly with status code 128″. Our W2K Server is connected directly to internet using leased line. If I disconnected the internet line, the system is running smoothly but if the internet line connected back, the system will start shutting down unexpectedly for at least 3 to 4 times a day. I have the latest service pack 4 and patches and service pack 4 security rollup installed but the problem still there. Please help how to fix this problem. Our sever hase Exchange 2003 installed.

I had the same problem with services.exe on Win2k SP4. If I unplugged the network cable the PC was fine. As soon as I plugged the network cable back in I would get the same error message and the PC would shutdown automatically.

I decided to uninstall and reinstall the driver for the ethernet card.

I have the same issue on a handfull of win2k pro sp4 desktops. Thats are restarting,
-virus outbreak in my network with the W32.Spybot.Worm
upgrated my clients to SAV 10.1 Cleaned all Infections.
-Computers still restarting MS KB dont work!

Just do a file search for lmhost, and host.
It should find it for you..
If it doesnt, you need to open up windows explorer, and go to folder options, and uncheck the option to hide protected operating system files.

Open the file with notepad, if it had a ton of entries in it, you need to delete out a bunch of them. Or most of them… Start at the bottem, and deleted the lines. Leave about the top 5 entries.

found the following error that :
“The system process c:\WINNT\System32\Services.exe” terminated unexpectedly with status code 128. The system will now shutdown and restart.” this error comes in recently .

This Money makers System Makes Me At Least $171,168.06 Per Month And You Can Start Using This Money makers 15 Minutes From Now! http://getmymoneymakers.com/
“Guaranteed to work even if you’re “un-motivated”…
In fact, it’s best if you only put in an hour or so per day!”